構成

インターフェース	目的
eth0	ssh 接続 (vrf MGT)
eth1	ルーターの先の LAN
eth2	インターネット (pppoe)
pppoe	pppoe トンネル
vit10	vpn トンネル
dum0	通信試験用 (ルーターの先の LAN)

基本設定

set system host-name VyOS-19
set system domain-name home.my
set system login user vyos authentication encrypted-password vyos
delete system login user vyos authentication plaintext-password
set system time-zone Asia/Tokyo

set service lldp interface all
set service lldp legacy-protocols cdp
set service ntp server 172.30.10.254

set interfaces ethernet eth1 address 172.16.0.19/24
set interfaces ethernet eth2

vrf、マネージメント設定

set vrf name MGT ip disable-forwarding
set vrf name MGT table 100

set interfaces ethernet eth0 address 172.30.10.19/24
set interfaces ethernet eth0 description MGT
set interfaces ethernet eth0 vrf MGT

set service ntp vrf MGT
set service ssh listen-address '172.30.10.19'
set service ssh vrf MGT

管理用 LAN を vrf MGT にして、サービス用ネットワークからログインできないよう分離。
ntp も管理用 LAN を利用。

pppoe 設定

set interfaces pppoe pppoe0 authentication password pass_Center
set interfaces pppoe pppoe0 authentication username Center@Cisco
set interfaces pppoe pppoe0 description to_PPPoE
set interfaces pppoe pppoe0 mtu 1454
set interfaces pppoe pppoe0 source-interface eth2

pppoe の設定

VPN 設定

vpn 共通部分

IKE ＆ ESP

set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-dh-group32'
set vpn ipsec esp-group ESP_DEFAULT proposal 1 encryption 'aes256gcm128'
set vpn ipsec esp-group ESP_DEFAULT proposal 1 hash 'sha512'
set vpn ipsec ike-group IKE_DEFAULT dead-peer-detection action 'restart'
set vpn ipsec ike-group IKE_DEFAULT dead-peer-detection interval '15'
set vpn ipsec ike-group IKE_DEFAULT dead-peer-detection timeout '30'
set vpn ipsec ike-group IKE_DEFAULT ikev2-reauth
set vpn ipsec ike-group IKE_DEFAULT key-exchange 'ikev2'
set vpn ipsec ike-group IKE_DEFAULT lifetime '28800'
set vpn ipsec ike-group IKE_DEFAULT proposal 1 dh-group '31'
set vpn ipsec ike-group IKE_DEFAULT proposal 1 encryption 'chacha20poly1305'
set vpn ipsec ike-group IKE_DEFAULT proposal 1 hash 'sha512'
set vpn ipsec interface 'pppoe0'

IKEv2 sa (IKEv1 の Phase1 / IKE sa) の lifetime は 24時間程度
IPsec sa (IKEv1 の Phase2 / Child sa) の lifetime は数時間程度にすることが多い

# この id は対向だけあれば良いけど
# 両方入れても問題ないので両方とも書いて共通設定とする
set vpn ipsec authentication psk Site2Site id '100.64.0.29'
set vpn ipsec authentication psk Site2Site id '100.64.0.19'
set vpn ipsec authentication psk Site2Site secret 'secret_ABC-def'

set vpn ipsec site-to-site peer Site2Site authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer Site2Site ike-group 'IKE_DEFAULT'
set vpn ipsec site-to-site peer Site2Site vti bind 'vti10'
set vpn ipsec site-to-site peer Site2Site vti esp-group 'ESP_DEFAULT'

vpn センター側

set interfaces vti vti10
set interfaces vti vti10 address '172.16.99.19/24'
set interfaces vti vti10 description 'to_SiteA'
set interfaces vti vti10 ip adjust-mss '1350'

set vpn ipsec site-to-site peer Site2Site authentication local-id '100.64.0.19'
set vpn ipsec site-to-site peer Site2Site authentication remote-id '100.64.0.29'
set vpn ipsec site-to-site peer Site2Site local-address '100.64.0.19'
set vpn ipsec site-to-site peer Site2Site remote-address '100.64.0.29'

set interfaces dummy dum0 address 172.17.19.0/32
set protocols static route 172.17.0.0/16 interface vti10

dum0 は通信試験用。dum0 向けのルートを vpn トンネルに向ける。

拠点A (差分のみ)

set system host-name VyOS-29

set interfaces ethernet eth0 address 172.30.10.29/24
set interfaces ethernet eth1 address 172.16.0.29/24
set service ssh listen-address '172.30.10.29'

# pppoe
set interfaces pppoe pppoe0 authentication password pass_A
set interfaces pppoe pppoe0 authentication username site-A@Cisco

# vpn
set interfaces vti vti10 address '172.16.99.29/24'
set vpn ipsec site-to-site peer Site2Site authentication local-id '100.64.0.29'
set vpn ipsec site-to-site peer Site2Site authentication remote-id '100.64.0.19'
set vpn ipsec site-to-site peer Site2Site local-address '100.64.0.29'
set vpn ipsec site-to-site peer Site2Site remote-address '100.64.0.19'

set interfaces dummy dum0 address 172.17.29.0/32

172.17.0.0/16 向けのルーティングが適当なので、一対一の VPN にしか使えません。
一対多の場合はセンターから各拠点向けを一つづつ書いていく必要があります。

最低限の設定としては以下が参考になると思います。

状態確認

センター側

vyos@VyOS-19:~$ show vpn ike sa
Peer ID / IP                            Local ID / IP
------------                            -------------
100.64.0.29 100.64.0.29                 100.64.0.19 100.64.0.19

    State  IKEVer  Encrypt      Hash          D-H Group      NAT-T  A-Time  L-Time
    -----  ------  -------      ----          ---------      -----  ------  ------
    up     IKEv2   CHACHA20_POLY1305 n/a           CURVE_25519    no     817     0

vyos@VyOS-19:~$
vyos@VyOS-19:~$ show vpn ike secrets
PSK        Id           Secret
---------  -----------  --------------
Site2Site  100.64.0.19  secret_ABC-def
           100.64.0.29
vyos@VyOS-19:~$
vyos@VyOS-19:~$ show vpn ipsec connections
Connection     State    Type    Remote address    Local TS    Remote TS    Local id     Remote id    Proposal
-------------  -------  ------  ----------------  ----------  -----------  -----------  -----------  ---------------------------------------
Site2Site      up       IKEv2   100.64.0.29       -           -            100.64.0.19  100.64.0.29  CHACHA20_POLY1305/None/None/CURVE_25519
Site2Site-vti  up       IPsec   100.64.0.29       0.0.0.0/0   0.0.0.0/0    100.64.0.19  100.64.0.29  AES_GCM/256/None/None
                                                  ::/0        ::/0
vyos@VyOS-19:~$
vyos@VyOS-19:~$ show vpn ipsec sa
Connection     State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
-------------  -------  --------  --------------  ----------------  ----------------  -----------  --------------
Site2Site-vti  up       40m46s    0B/0B           0/0               100.64.0.29       100.64.0.29  AES_GCM_16_256
Site2Site-vti  up       40m52s    0B/0B           0/0               100.64.0.29       100.64.0.29  AES_GCM_16_256
vyos@VyOS-19:~$
vyos@VyOS-19:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address       MAC                VRF        MTU  S/L    Description
-----------  ---------------  -----------------  -------  -----  -----  -------------
dum0         172.17.0.19/32   4e:ea:ac:b2:50:38  default   1500  u/u
eth0         172.30.10.19/24  00:0c:29:3f:f6:f2  MGT       1500  u/u    MGT
eth1         172.16.0.19/24   00:0c:29:3f:f6:fc  default   1500  u/u    to_vEOS-21
eth2         -                00:0c:29:3f:f6:06  default   1500  u/u
lo           127.0.0.1/8      00:00:00:00:00:00  default  65536  u/u
             ::1/128
pppoe0       100.64.0.19/32   n/a                default   1454  u/u    to_PPPoE
vti10        172.16.99.19/24  n/a                default   1500  u/u    to_Center
vyos@VyOS-19:~$
vyos@VyOS-19:~$ ping 172.17.0.29 source-address  172.17.0.19
PING 172.17.0.29 (172.17.0.29) from 172.17.0.19 : 56(84) bytes of data.
64 bytes from 172.17.0.29: icmp_seq=1 ttl=64 time=0.952 ms
64 bytes from 172.17.0.29: icmp_seq=2 ttl=64 time=1.16 ms
64 bytes from 172.17.0.29: icmp_seq=3 ttl=64 time=1.03 ms
64 bytes from 172.17.0.29: icmp_seq=4 ttl=64 time=1.08 ms
^C
--- 172.17.0.29 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 0.952/1.053/1.157/0.074 ms
vyos@VyOS-19:~$

パケットキャプチャ

トンネルの中 (vti10) と外 (pppoe0) を同時にキャプチャ

vyos@VyOS-19:~$  ( tcpdump -i vti10 > /dev/tty &) | ( tcpdump -i pppoe0 )
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on vti10, link-type RAW (Raw IP), snapshot length 262144 bytes
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on pppoe0, link-type LINUX_SLL (Linux cooked v1), snapshot length 262144 bytes
23:08:15.719811 IP 100.64.0.29.ipsec-nat-t > 100.64.0.19.ipsec-nat-t: NONESP-encap: isakmp: child_sa  inf2
23:08:15.965494 IP 100.64.0.29.ipsec-nat-t > 100.64.0.19.ipsec-nat-t: NONESP-encap: isakmp: child_sa  inf2[I]
23:08:15.972373 IP 100.64.0.19.ipsec-nat-t > 100.64.0.29.ipsec-nat-t: NONESP-encap: isakmp: child_sa  inf2[IR]
23:08:16.205793 IP 100.64.0.19.ipsec-nat-t > 100.64.0.29.ipsec-nat-t: NONESP-encap: isakmp: child_sa  inf2[R]
23:08:16.288026 IP 100.64.0.29.isakmp > 100.64.0.19.isakmp: isakmp: parent_sa ikev2_init[I]
23:08:16.288776 IP 100.64.0.19.isakmp > 100.64.0.29.isakmp: isakmp: parent_sa ikev2_init[R]
23:08:16.290203 IP 100.64.0.29.ipsec-nat-t > 100.64.0.19.ipsec-nat-t: NONESP-encap: isakmp: child_sa  ikev2_auth[I]
23:08:16.624455 IP 100.64.0.19.ipsec-nat-t > 100.64.0.29.ipsec-nat-t: NONESP-encap: isakmp: child_sa  ikev2_auth[R]
23:08:21.045392 IP 172.17.0.29 > 172.17.0.19: ICMP echo request, id 16806, seq 1, length 64
23:08:21.045423 IP 172.17.0.19 > 172.17.0.29: ICMP echo reply, id 16806, seq 1, length 64
23:08:21.045305 IP 100.64.0.29 > 100.64.0.19: ESP(spi=0xc9d4df77,seq=0x1), length 120
23:08:21.045440 IP 100.64.0.19 > 100.64.0.29: ESP(spi=0xc02a0c0d,seq=0x1), length 120
23:08:22.046958 IP 172.17.0.29 > 172.17.0.19: ICMP echo request, id 16806, seq 2, length 64
23:08:22.046992 IP 172.17.0.19 > 172.17.0.29: ICMP echo reply, id 16806, seq 2, length 64
23:08:22.046866 IP 100.64.0.29 > 100.64.0.19: ESP(spi=0xc9d4df77,seq=0x2), length 120
23:08:22.047010 IP 100.64.0.19 > 100.64.0.29: ESP(spi=0xc02a0c0d,seq=0x2), length 120
23:08:23.048330 IP 172.17.0.29 > 172.17.0.19: ICMP echo request, id 16806, seq 3, length 64
23:08:23.048351 IP 172.17.0.19 > 172.17.0.29: ICMP echo reply, id 16806, seq 3, length 64
23:08:23.048275 IP 100.64.0.29 > 100.64.0.19: ESP(spi=0xc9d4df77,seq=0x3), length 120
23:08:23.048363 IP 100.64.0.19 > 100.64.0.29: ESP(spi=0xc02a0c0d,seq=0x3), length 120
^C

6 packets captured
6 packets received by filter
0 packets dropped by kernel
14 packets captured
14 packets received by filter
0 packets dropped by kernel
vyos@VyOS-19:~$

意図してなかったのですがセンターの eth1 : 172.16.0.19/24 と、拠点 A の eth1 : 172.16.0.29/24 が繋がってますねぇ。L2 を伸ばすことができるんですねぇ。一対一だから通るのかな。一対多だと、ホスト単位でルーティングを書かないと通らないでしょうね。
dum0 の 172.17.0.19/32 と 172.17.0.29/32 がルータの下の LAN というイメージだったのですが。